Examples with OIDCAdvancedConfigWrapper org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper used on opensource projects

Example 11 with OIDCAdvancedConfigWrapper

use of org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper in project keycloak by keycloak.

the class ClientPublicKeyLoader method loadKeys.

@Override
public Map<String, KeyWrapper> loadKeys() throws Exception {
    OIDCAdvancedConfigWrapper config = OIDCAdvancedConfigWrapper.fromClientModel(client);
    if (config.isUseJwksUrl()) {
        String jwksUrl = config.getJwksUrl();
        jwksUrl = ResolveRelative.resolveRelativeUri(session, client.getRootUrl(), jwksUrl);
        JSONWebKeySet jwks = JWKSHttpUtils.sendJwksRequest(session, jwksUrl);
        return JWKSUtils.getKeyWrappersForUse(jwks, keyUse);
    } else if (config.isUseJwksString()) {
        JSONWebKeySet jwks = JsonSerialization.readValue(config.getJwksString(), JSONWebKeySet.class);
        return JWKSUtils.getKeyWrappersForUse(jwks, keyUse);
    } else if (keyUse == JWK.Use.SIG) {
        try {
            CertificateRepresentation certInfo = CertificateInfoHelper.getCertificateFromClient(client, JWTClientAuthenticator.ATTR_PREFIX);
            KeyWrapper publicKey = getSignatureValidationKey(certInfo);
            return Collections.singletonMap(publicKey.getKid(), publicKey);
        } catch (ModelException me) {
            logger.warnf(me, "Unable to retrieve publicKey for verify signature of client '%s' . Error details: %s", client.getClientId(), me.getMessage());
            return Collections.emptyMap();
        }
    } else {
        logger.warnf("Unable to retrieve publicKey of client '%s' for the specified purpose other than verifying signature", client.getClientId());
        return Collections.emptyMap();
    }
}

Example 12 with OIDCAdvancedConfigWrapper

use of org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper in project keycloak by keycloak.

the class FAPI1Test method testFAPIAdvancedSignatureAlgorithms.

@Test
public void testFAPIAdvancedSignatureAlgorithms() throws Exception {
    // Set "advanced" policy
    setupPolicyFAPIAdvancedForAllClient();
    // Test that unsecured algorithm (RS256) is not possible
    try {
        createClientByAdmin("invalid", (ClientRepresentation clientRep) -> {
            clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
            OIDCAdvancedConfigWrapper clientConfig = OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep);
            clientConfig.setIdTokenSignedResponseAlg(Algorithm.RS256);
        });
        fail();
    } catch (ClientPolicyException e) {
        assertEquals(OAuthErrorException.INVALID_REQUEST, e.getMessage());
    }
    // Test that secured algorithm is possible to explicitly set
    String clientUUID = createClientByAdmin("client-jwt", (ClientRepresentation clientRep) -> {
        clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
        OIDCAdvancedConfigWrapper clientCfg = OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep);
        clientCfg.setIdTokenSignedResponseAlg(Algorithm.ES256);
    });
    ClientRepresentation client = getClientByAdmin(clientUUID);
    OIDCAdvancedConfigWrapper clientConfig = OIDCAdvancedConfigWrapper.fromClientRepresentation(client);
    Assert.assertEquals(Algorithm.ES256, clientConfig.getIdTokenSignedResponseAlg());
    Assert.assertEquals(Algorithm.PS256, clientConfig.getRequestObjectSignatureAlg().toString());
    // Test default algorithms set everywhere
    clientUUID = createClientByAdmin("client-jwt-default-alg", (ClientRepresentation clientRep) -> {
        clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
    });
    client = getClientByAdmin(clientUUID);
    clientConfig = OIDCAdvancedConfigWrapper.fromClientRepresentation(client);
    Assert.assertEquals(Algorithm.PS256, clientConfig.getIdTokenSignedResponseAlg());
    Assert.assertEquals(Algorithm.PS256, clientConfig.getRequestObjectSignatureAlg().toString());
    Assert.assertEquals(Algorithm.PS256, clientConfig.getUserInfoSignedResponseAlg().toString());
    Assert.assertEquals(Algorithm.PS256, clientConfig.getTokenEndpointAuthSigningAlg());
    Assert.assertEquals(Algorithm.PS256, client.getAttributes().get(OIDCConfigAttributes.ACCESS_TOKEN_SIGNED_RESPONSE_ALG));
}

Example 13 with OIDCAdvancedConfigWrapper

use of org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper in project keycloak by keycloak.

the class FAPI1Test method testFAPIAdvancedLoginWithMTLS.

@Test
public void testFAPIAdvancedLoginWithMTLS() throws Exception {
    // Set "advanced" policy
    setupPolicyFAPIAdvancedForAllClient();
    // Register client with X509
    String clientUUID = createClientByAdmin("foo", (ClientRepresentation clientRep) -> {
        clientRep.setClientAuthenticatorType(X509ClientAuthenticator.PROVIDER_ID);
        clientRep.setImplicitFlowEnabled(true);
        OIDCAdvancedConfigWrapper clientConfig = OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep);
        clientConfig.setRequestUris(Collections.singletonList(TestApplicationResourceUrls.clientRequestUri()));
        clientConfig.setTlsClientAuthSubjectDn("EMAILADDRESS=contact@keycloak.org, CN=Keycloak Intermediate CA, OU=Keycloak, O=Red Hat, ST=MA, C=US");
    });
    ClientResource clientResource = adminClient.realm(REALM_NAME).clients().get(clientUUID);
    ClientRepresentation client = clientResource.toRepresentation();
    assertEquals(X509ClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
    // Check nonce and redirectUri
    oauth.clientId("foo");
    checkNonceAndStateForCurrentClientDuringLogin();
    checkRedirectUriForCurrentClientDuringLogin();
    // Check login request object required
    oauth.openLoginForm();
    assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST, false, "Missing parameter: 'request' or 'request_uri'");
    // Set request object and correct responseType
    TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject requestObject = createValidRequestObjectForSecureRequestObjectExecutor("foo");
    // Nonce from method "checkNonceAndStateForCurrentClientDuringLogin()"
    requestObject.setNonce("123456");
    oauth.responseType(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN);
    requestObject.setResponseType(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN);
    registerRequestObject(requestObject, "foo", org.keycloak.jose.jws.Algorithm.PS256, true);
    oauth.openLoginForm();
    loginPage.assertCurrent();
    String code = loginUserAndGetCode("foo", true);
    // Check token not present in the AuthorizationResponse. Check ID Token present, but used as detached signature
    Assert.assertNull(getParameterFromUrl(OAuth2Constants.ACCESS_TOKEN, true));
    String idTokenParam = getParameterFromUrl(OAuth2Constants.ID_TOKEN, true);
    assertIDTokenAsDetachedSignature(idTokenParam, code);
    // Check HoK required
    OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, null);
    assertSuccessfulTokenResponse(tokenResponse);
    AccessToken accessToken = oauth.verifyToken(tokenResponse.getAccessToken());
    Assert.assertNotNull(accessToken.getCertConf().getCertThumbprint());
    // Logout and remove consent of the user for next logins
    logoutUserAndRevokeConsent("foo");
}

Example 14 with OIDCAdvancedConfigWrapper

use of org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper in project keycloak by keycloak.

the class OIDCClientRegistrationTest method testMtlsHoKTokenEnabled.

// KEYCLOAK-6771 Certificate Bound Token
// https://tools.ietf.org/html/draft-ietf-oauth-mtls-08#section-6.5
@Test
public void testMtlsHoKTokenEnabled() throws Exception {
    // create (no specification)
    OIDCClientRepresentation clientRep = createRep();
    OIDCClientRepresentation response = reg.oidc().create(clientRep);
    Assert.assertEquals(Boolean.FALSE, response.getTlsClientCertificateBoundAccessTokens());
    Assert.assertNotNull(response.getClientSecret());
    // Test Keycloak representation
    ClientRepresentation kcClient = getClient(response.getClientId());
    OIDCAdvancedConfigWrapper config = OIDCAdvancedConfigWrapper.fromClientRepresentation(kcClient);
    assertTrue(!config.isUseMtlsHokToken());
    // update (true)
    reg.auth(Auth.token(response));
    response.setTlsClientCertificateBoundAccessTokens(Boolean.TRUE);
    OIDCClientRepresentation updated = reg.oidc().update(response);
    assertTrue(updated.getTlsClientCertificateBoundAccessTokens().booleanValue());
    // Test Keycloak representation
    kcClient = getClient(updated.getClientId());
    config = OIDCAdvancedConfigWrapper.fromClientRepresentation(kcClient);
    assertTrue(config.isUseMtlsHokToken());
    // update (false)
    reg.auth(Auth.token(updated));
    updated.setTlsClientCertificateBoundAccessTokens(Boolean.FALSE);
    OIDCClientRepresentation reUpdated = reg.oidc().update(updated);
    assertTrue(!reUpdated.getTlsClientCertificateBoundAccessTokens().booleanValue());
    // Test Keycloak representation
    kcClient = getClient(reUpdated.getClientId());
    config = OIDCAdvancedConfigWrapper.fromClientRepresentation(kcClient);
    assertTrue(!config.isUseMtlsHokToken());
}

Example 15 with OIDCAdvancedConfigWrapper

use of org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper in project keycloak by keycloak.

the class OIDCClientRegistrationTest method testIdTokenEncryptedResponse.

@Test
public void testIdTokenEncryptedResponse() throws Exception {
    OIDCClientRepresentation response = null;
    OIDCClientRepresentation updated = null;
    try {
        // create (no specification)
        OIDCClientRepresentation clientRep = createRep();
        response = reg.oidc().create(clientRep);
        Assert.assertEquals(Boolean.FALSE, response.getTlsClientCertificateBoundAccessTokens());
        Assert.assertNotNull(response.getClientSecret());
        // Test Keycloak representation
        ClientRepresentation kcClient = getClient(response.getClientId());
        OIDCAdvancedConfigWrapper config = OIDCAdvancedConfigWrapper.fromClientRepresentation(kcClient);
        Assert.assertNull(config.getIdTokenEncryptedResponseAlg());
        Assert.assertNull(config.getIdTokenEncryptedResponseEnc());
        // update (alg RSA1_5, enc A128CBC-HS256)
        reg.auth(Auth.token(response));
        response.setIdTokenEncryptedResponseAlg(JWEConstants.RSA1_5);
        response.setIdTokenEncryptedResponseEnc(JWEConstants.A128CBC_HS256);
        updated = reg.oidc().update(response);
        Assert.assertEquals(JWEConstants.RSA1_5, updated.getIdTokenEncryptedResponseAlg());
        Assert.assertEquals(JWEConstants.A128CBC_HS256, updated.getIdTokenEncryptedResponseEnc());
        // Test Keycloak representation
        kcClient = getClient(updated.getClientId());
        config = OIDCAdvancedConfigWrapper.fromClientRepresentation(kcClient);
        Assert.assertEquals(JWEConstants.RSA1_5, config.getIdTokenEncryptedResponseAlg());
        Assert.assertEquals(JWEConstants.A128CBC_HS256, config.getIdTokenEncryptedResponseEnc());
    } finally {
        // revert
        reg.auth(Auth.token(updated));
        updated.setIdTokenEncryptedResponseAlg(null);
        updated.setIdTokenEncryptedResponseEnc(null);
        reg.oidc().update(updated);
    }
}